Hacker News Reader

Comment by Narkov | Hacker News Reader

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

View on HN

I did that. Then saw that filtering was inconsistent. It turns out that some systems treat the DNS list as alternatives, not as primary and failover.

The spec only says the dns IPs should be specified in preference order. Nothing says to treat it as primary and failover.

Oh wow that might explain why my SO is sometimes filtered and sometimes not.

I've got her on an exclusion list because she just cares about being able to click on Google ads also known as "search results".

But I might not have added her on the backup Pihole now that I think of it...

Yeah, far too many devices and apps seem to use DNS in a more round robin fashion. Too inconsistent for my liking.

Quite a few DNS clients don't make any distinction between "primary" and "secondary". You may enter them in order when configuring them but that has no bearing on which ends up being the server queries are sent to.

I found windows to be like this. It has no specific order on primary or secondary. However, occasionally it will latch on to one of them and continue sending several lookups to that one.

AFAIK that won't work reliably with Windows. It will spray requests to all configured DNS servers and use whichever response comes back the quickest.

If you can guarantee that the PiHole will always be fastest, it should be OK. But I'd be curious to see how you'd go about guaranteeing that.

The problem is that many devices instantly spill over to the secondary Pi-Hole. And rogue devices bypass the primary altogether once they begin to get blocked for a short period of time. Having a secondary without blocking nearly negates the benefit of having the primary pi-hole, for the devices that it matters for most.

This is why you need a port 53 ban on your network that blocks all traffic except to your piholes ips. Keeps rogue machines from reaching the internet for queries

Have you tried this for yourself?

It’s an approach I assumed would work when I did my first setup, but since there’s really no such thing as primary and secondary (or tertiary) resolver, I quickly realized it did not work consistently on most devices.

I did, and according to the man page of /etc/resolv.conf the order is taken into account unless you specifically set the option not to. Which covers macOS, i(Pad)OS and Linux, and afaik also my Windows machine (I haven't checked the latter though).

I did this and started to wonder why every web page opened reeaaallly slowly.

Turns out the Pi-Hole Raspberry Pi had borked and wasn't answering at all, my computer was waiting for the primary DNS _every_time_ for multiple seconds before trying the secondary one.

What it should've done (IMO) is query both and pick the fastest.

Swapped to NextDNS and haven't looked back, I set it on my router and mobile devices once and that's it.

def don't do this unless you want dns leaks all over the place. the pi-hole should be the only dns server in its networks. you can also use it as a dhcp server to work around ISP routers blocking DNS modification.

That will not work. The naming primary/secondary doesn't mean what you think with dns. You should always set only the primary or both the same.

That's exactly what I do. Never been concerned about downtime with my pihole, except the odd smart TV is something that won't using the secondary dns

Depends on what you're using it for. If you're trying to block privacy threats like SuperHuman pixels you don't want it to fall back to ISP.

Reply on news.ycombinator.com